Add asset checkout, quantity/uniqueness, contacts, and QR labels

Checkout:
- assets.AssignUser + POST /app/assets/{id}/checkout assign/unassign an
  asset's user independent of the full edit form. New shared
  #checkoutModal, wired from a "Check Out..." context-menu action, backed
  by GET /app/assets/{id} and GET /app/users/options JSON endpoints.

Quantity / uniqueness:
- Item types gain an IsUnique flag (checked by default, matching prior
  behavior). Assets gain a Quantity column, fixed at 1 for unique types
  and adjustable via +/- steppers (POST /app/assets/{id}/quantity) for
  non-unique ones. Flipping a type back to unique clamps existing assets'
  quantity back to 1. CSV import/export gained a Quantity column.
  Migration 0003_quantity.sql.

Contacts:
- New models.RoleContact: an assignable person who cannot sign in
  (User.CanLogin). Migration 0004_contacts.sql rebuilds the users table
  (SQLite can't alter a CHECK constraint in place) to allow the role.
  Users form/list updated; contact creation auto-generates an unusable
  password since the login path is blocked by role regardless.

QR asset tags and printable labels:
- Each asset's QR code (via github.com/skip2/go-qrcode, pure Go) encodes
  an absolute /scan/<tag> URL; GET /scan/{tag} resolves it and redirects
  into /inventory?asset=<id>, which app.js picks up on load to
  auto-select that asset - works from a phone camera or a USB
  scanner-as-keyboard-wedge pointed at the address bar.
- GET /labels renders a print-ready sheet (right-click an asset for one
  label, a folder for every asset in it) with a template switcher between
  Avery 5160 (verified dimensions) and 61526 asset tag labels (best-effort
  layout, flagged as such on the page).

Also refreshed README to reflect the right-click-first tree UX and all of
the above.

internal/users/users.go

@@ -16,10 +16,14 @@ var (
 	ErrNotFound         = errors.New("user not found")
 	ErrUsernameRequired = errors.New("username is required")
 	ErrUsernameTaken    = errors.New("username is already taken")
-	ErrInvalidRole      = errors.New("role must be admin or user")
+	ErrInvalidRole      = errors.New("role must be admin, user, or contact")
 	ErrLastAdmin        = errors.New("cannot remove the last enabled admin")
 )
 
+func validRole(r models.Role) bool {
+	return r == models.RoleAdmin || r == models.RoleUser || r == models.RoleContact
+}
+
 type Store struct{ db *sql.DB }
 
 func NewStore(db *sql.DB) *Store { return &Store{db: db} }
@@ -82,7 +86,7 @@ func (s *Store) Create(ctx context.Context, u *models.User, plaintextPassword st
 	if u.Username == "" {
 		return ErrUsernameRequired
 	}
-	if u.Role != models.RoleAdmin && u.Role != models.RoleUser {
+	if !validRole(u.Role) {
 		return ErrInvalidRole
 	}
 	if _, err := s.GetByUsername(ctx, u.Username); err == nil {
@@ -113,7 +117,7 @@ func (s *Store) Update(ctx context.Context, u *models.User) error {
 	if u.Username == "" {
 		return ErrUsernameRequired
 	}
-	if u.Role != models.RoleAdmin && u.Role != models.RoleUser {
+	if !validRole(u.Role) {
 		return ErrInvalidRole
 	}
 	if existing, err := s.GetByUsername(ctx, u.Username); err == nil && existing.ID != u.ID {
@@ -179,6 +183,9 @@ func (s *Store) Authenticate(ctx context.Context, username, password string) (*m
 	if !u.Enabled {
 		return nil, errors.New("account is disabled")
 	}
+	if !u.CanLogin() {
+		return nil, errors.New("this account cannot sign in")
+	}
 	if err := bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte(password)); err != nil {
 		return nil, errors.New("invalid credentials")
 	}